Safe Haskell	None
Language	GHC2021

Ecluse.Core.Osv.Advisory

Synopsis

data OsvAdvisory = OsvAdvisory {
- osvId :: Text
- osvAffected :: Maybe [OsvAffected]
- osvSeverity :: Maybe [OsvSeverityEntry]
- osvDatabaseSpecific :: Maybe OsvDatabaseSpecific
}
data OsvAffected = OsvAffected {
- affectedPackage :: OsvPackage
- affectedRanges :: Maybe [OsvRange]
- affectedVersions :: Maybe [Text]
}
data OsvPackage = OsvPackage {
- packageName :: Text
- packageEcosystem :: Text
}
data OsvRange = OsvRange {
- rangeType :: Text
- rangeEvents :: [OsvEvent]
}
data OsvEvent = OsvEvent {
- eventIntroduced :: Maybe Text
- eventFixed :: Maybe Text
- eventLastAffected :: Maybe Text
}
newtype OsvDatabaseSpecific = OsvDatabaseSpecific {
- dbsSeverity :: Maybe Text
}
data OsvSeverityEntry = OsvSeverityEntry {
- sevType :: Text
- sevScore :: Text
}
data ExtractedOsv = ExtractedOsv {
- extPackage :: Text
- extEcosystem :: Text
- extCveId :: Text
- extIntroduced :: Maybe Text
- extFixed :: Maybe Text
- extLastAffected :: Maybe Text
- extSeverity :: Maybe Double
}
advisorySeverity :: OsvAdvisory -> Maybe Double
extractFromAdvisory :: OsvAdvisory -> [ExtractedOsv]
osvExportUrl :: Text -> Text -> String

Documentation

data OsvAdvisory Source #

Exact model of what osv.dev makes available

Constructors

OsvAdvisory
Fields osvId :: Text osvAffected :: Maybe [OsvAffected] osvSeverity :: Maybe [OsvSeverityEntry] osvDatabaseSpecific :: Maybe OsvDatabaseSpecific

Instances

Instances details

FromJSON OsvAdvisory Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods parseJSON :: Value -> Parser OsvAdvisory Source # parseJSONList :: Value -> Parser [OsvAdvisory] Source # omittedField :: Maybe OsvAdvisory Source #
Show OsvAdvisory Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods showsPrec :: Int -> OsvAdvisory -> ShowS # show :: OsvAdvisory -> String # showList :: [OsvAdvisory] -> ShowS #
Eq OsvAdvisory Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods (==) :: OsvAdvisory -> OsvAdvisory -> Bool # (/=) :: OsvAdvisory -> OsvAdvisory -> Bool #

data OsvAffected Source #

Constructors

OsvAffected
Fields affectedPackage :: OsvPackage affectedRanges :: Maybe [OsvRange] affectedVersions :: Maybe [Text] Exact affected versions enumerated outside any range. A real and common OSV shape (much of the npm malware feed names the single bad version here with no `ranges` at all); each is an affected point in its own right.

Instances

Instances details

FromJSON OsvAffected Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods parseJSON :: Value -> Parser OsvAffected Source # parseJSONList :: Value -> Parser [OsvAffected] Source # omittedField :: Maybe OsvAffected Source #
Show OsvAffected Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods showsPrec :: Int -> OsvAffected -> ShowS # show :: OsvAffected -> String # showList :: [OsvAffected] -> ShowS #
Eq OsvAffected Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods (==) :: OsvAffected -> OsvAffected -> Bool # (/=) :: OsvAffected -> OsvAffected -> Bool #

data OsvPackage Source #

Constructors

OsvPackage
Fields packageName :: Text packageEcosystem :: Text

Instances

Instances details

FromJSON OsvPackage Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods parseJSON :: Value -> Parser OsvPackage Source # parseJSONList :: Value -> Parser [OsvPackage] Source # omittedField :: Maybe OsvPackage Source #
Show OsvPackage Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods showsPrec :: Int -> OsvPackage -> ShowS # show :: OsvPackage -> String # showList :: [OsvPackage] -> ShowS #
Eq OsvPackage Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods (==) :: OsvPackage -> OsvPackage -> Bool # (/=) :: OsvPackage -> OsvPackage -> Bool #

data OsvRange Source #

Constructors

OsvRange
Fields rangeType :: Text rangeEvents :: [OsvEvent]

Instances

Instances details

FromJSON OsvRange Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods parseJSON :: Value -> Parser OsvRange Source # parseJSONList :: Value -> Parser [OsvRange] Source # omittedField :: Maybe OsvRange Source #
Show OsvRange Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods showsPrec :: Int -> OsvRange -> ShowS # show :: OsvRange -> String # showList :: [OsvRange] -> ShowS #
Eq OsvRange Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods (==) :: OsvRange -> OsvRange -> Bool # (/=) :: OsvRange -> OsvRange -> Bool #

data OsvEvent Source #

One event in a range's ordered event list. An event carries exactly one bound: introduced opens the affected interval (inclusive), fixed closes it below the fix (exclusive), and last_affected closes it at an inclusive upper bound. The two upper bounds are genuinely different -- fixed 2.0 excludes 2.0, last_affected 2.0 includes it -- so they are decoded and carried separately.

Constructors

OsvEvent
Fields eventIntroduced :: Maybe Text eventFixed :: Maybe Text eventLastAffected :: Maybe Text

Instances

Instances details

FromJSON OsvEvent Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods parseJSON :: Value -> Parser OsvEvent Source # parseJSONList :: Value -> Parser [OsvEvent] Source # omittedField :: Maybe OsvEvent Source #
Show OsvEvent Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods showsPrec :: Int -> OsvEvent -> ShowS # show :: OsvEvent -> String # showList :: [OsvEvent] -> ShowS #
Eq OsvEvent Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods (==) :: OsvEvent -> OsvEvent -> Bool # (/=) :: OsvEvent -> OsvEvent -> Bool #

newtype OsvDatabaseSpecific Source #

The subset of an advisory's database_specific block the pipeline consumes.

Constructors

OsvDatabaseSpecific
Fields dbsSeverity :: Maybe Text The source database's qualitative severity label (for GHSA-sourced npm advisories: `LOW`, `MODERATE`, `HIGH`, or `CRITICAL`).

Instances

Instances details

FromJSON OsvDatabaseSpecific Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods parseJSON :: Value -> Parser OsvDatabaseSpecific Source # parseJSONList :: Value -> Parser [OsvDatabaseSpecific] Source # omittedField :: Maybe OsvDatabaseSpecific Source #
Show OsvDatabaseSpecific Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods showsPrec :: Int -> OsvDatabaseSpecific -> ShowS # show :: OsvDatabaseSpecific -> String # showList :: [OsvDatabaseSpecific] -> ShowS #
Eq OsvDatabaseSpecific Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods (==) :: OsvDatabaseSpecific -> OsvDatabaseSpecific -> Bool # (/=) :: OsvDatabaseSpecific -> OsvDatabaseSpecific -> Bool #

data OsvSeverityEntry Source #

One entry of an advisory's severity array: a scoring-system tag (for example CVSS_V3) and its value. For the CVSS systems the value is the vector string, not a number; the numeric base score is computed from it (advisorySeverity).

Constructors

OsvSeverityEntry
Fields sevType :: Text sevScore :: Text

Instances

Instances details

FromJSON OsvSeverityEntry Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods parseJSON :: Value -> Parser OsvSeverityEntry Source # parseJSONList :: Value -> Parser [OsvSeverityEntry] Source # omittedField :: Maybe OsvSeverityEntry Source #
Show OsvSeverityEntry Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods showsPrec :: Int -> OsvSeverityEntry -> ShowS # show :: OsvSeverityEntry -> String # showList :: [OsvSeverityEntry] -> ShowS #
Eq OsvSeverityEntry Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods (==) :: OsvSeverityEntry -> OsvSeverityEntry -> Bool # (/=) :: OsvSeverityEntry -> OsvSeverityEntry -> Bool #

data ExtractedOsv Source #

One affected segment of one package, flattened for storage: the advisory identity and severity carried alongside the interval bounds. Each ExtractedOsv becomes a row of the artifact's ranges table.

The bounds mirror OSV's own model: extIntroduced is the inclusive lower bound (Nothing == from the beginning); the upper bound is extFixed (exclusive) or extLastAffected (inclusive) or neither (open-ended). An exact enumerated version becomes a point segment (introduced == last_affected == v).

Constructors

ExtractedOsv
Fields extPackage :: Text extEcosystem :: Text extCveId :: Text extIntroduced :: Maybe Text extFixed :: Maybe Text extLastAffected :: Maybe Text extSeverity :: Maybe Double The advisory's CVSS base score (0 to 10), carried onto each of its segments; `Nothing` when the advisory is unscored (much of the npm malware feed). See `advisorySeverity`.

Instances

Instances details

Show ExtractedOsv Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods showsPrec :: Int -> ExtractedOsv -> ShowS # show :: ExtractedOsv -> String # showList :: [ExtractedOsv] -> ShowS #
Eq ExtractedOsv Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods (==) :: ExtractedOsv -> ExtractedOsv -> Bool # (/=) :: ExtractedOsv -> ExtractedOsv -> Bool #

advisorySeverity :: OsvAdvisory -> Maybe Double Source #

The advisory's CVSS base score, normalised to a number at ingest so the stored artifact holds a single comparable form and the reader needs no parsing.

OSV carries severity as a CVSS vector string, not a number, so the score is computed from it with the Security.CVSS library (the highest, when several vectors parse). When no vector parses, the source database's qualitative label (dbsSeverity) is mapped to its band ceiling (ghsaSeverityCeiling). Nothing when the advisory offers neither.

extractFromAdvisory :: OsvAdvisory -> [ExtractedOsv] Source #

Flatten an advisory into one ExtractedOsv per affected segment: every range segment of every affected package, plus each exactly-enumerated version as a point. An advisory with neither ranges nor versions yields nothing.

osvExportUrl :: Text -> Text -> String Source #

An ecosystem's advisory export under an OSV-layout base URL (<base>/<ecosystem>/all.zip): a zip archive of every advisory currently published for the ecosystem. The base comes from configuration (osvExportBaseUrl), so a moved or mirrored upstream never needs a new binary; a trailing slash on the base is tolerated.

>>> osvExportUrl "https://osv-vulnerabilities.storage.googleapis.com/" "npm"
"https://osv-vulnerabilities.storage.googleapis.com/npm/all.zip"